{"data":{"ecosystem":"pypi","name":"langsmith","url":"https://aisecwatch.com/packages/pypi/langsmith","latestVersion":"0.14.7","firstReleaseAt":"2023-06-26T22:04:38.023Z","repository":"https://github.com/langchain-ai/langsmith-sdk","llm":{"exposure":"direct","depth":0,"integratedAt":"2025-03-14T23:37:24.553Z","integratedVersion":"0.3.15","sdks":["claude-agent-sdk","google-adk","google-genai","openai","openai-agents","strands"],"path":[]},"authority":{"profile":["http"],"fromDependencies":["pypi:requests"]},"dependencies":[{"ecosystem":"pypi","name":"claude-agent-sdk","versionSpec":">=0.1.0","scope":"extra:claude-agent-sdk"},{"ecosystem":"pypi","name":"google-adk","versionSpec":">=1.0.0","scope":"extra:google-adk"},{"ecosystem":"pypi","name":"google-genai","versionSpec":">=1.75","scope":"extra:gemini-live"},{"ecosystem":"pypi","name":"livekit-agents","versionSpec":">=1.6","scope":"extra:livekit"},{"ecosystem":"pypi","name":"openai","versionSpec":">=1.50","scope":"extra:openai-realtime"},{"ecosystem":"pypi","name":"openai-agents","versionSpec":">=0.0.3","scope":"extra:openai-agents"},{"ecosystem":"pypi","name":"pipecat-ai","versionSpec":">=1.0","scope":"extra:pipecat"},{"ecosystem":"pypi","name":"strands-agents","versionSpec":">=0.1.0","scope":"extra:strands-agents"},{"ecosystem":"pypi","name":"strands-agents-tools","versionSpec":">=0.2.0","scope":"extra:strands-agents"},{"ecosystem":"pypi","name":"anyio","versionSpec":">=3.5.0","scope":"runtime"},{"ecosystem":"pypi","name":"cachetools","versionSpec":">=5.0.0","scope":"extra:livekit"},{"ecosystem":"pypi","name":"distro","versionSpec":">=1.7.0","scope":"runtime"},{"ecosystem":"pypi","name":"httpx2","versionSpec":"<3,>=2","scope":"runtime"},{"ecosystem":"pypi","name":"langsmith-pyo3","versionSpec":">=0.1.0rc2","scope":"extra:langsmith-pyo3"},{"ecosystem":"pypi","name":"opentelemetry-api","versionSpec":">=1.30.0","scope":"extra:livekit"},{"ecosystem":"pypi","name":"opentelemetry-exporter-otlp-proto-http","versionSpec":">=1.30.0","scope":"extra:livekit"},{"ecosystem":"pypi","name":"opentelemetry-sdk","versionSpec":">=1.30.0","scope":"extra:livekit"},{"ecosystem":"pypi","name":"orjson","versionSpec":">=3.9.14","scope":"runtime"},{"ecosystem":"pypi","name":"packaging","versionSpec":">=23.2","scope":"runtime"},{"ecosystem":"pypi","name":"pydantic","versionSpec":"<3,>=2","scope":"runtime"},{"ecosystem":"pypi","name":"pyjwt","versionSpec":">=2.8.0","scope":"extra:sandbox-auth"},{"ecosystem":"pypi","name":"pytest","versionSpec":">=7.0.0","scope":"extra:pytest"},{"ecosystem":"pypi","name":"requests","versionSpec":">=2.0.0","scope":"runtime"},{"ecosystem":"pypi","name":"requests-toolbelt","versionSpec":">=1.0.0","scope":"runtime"},{"ecosystem":"pypi","name":"rich","versionSpec":">=13.9.4","scope":"extra:pytest"},{"ecosystem":"pypi","name":"sniffio","versionSpec":">=1.1","scope":"runtime"},{"ecosystem":"pypi","name":"typing-extensions","versionSpec":">=4.0.0","scope":"runtime"},{"ecosystem":"pypi","name":"uuid-utils","versionSpec":"<1.0,>=0.12.0","scope":"runtime"},{"ecosystem":"pypi","name":"vcrpy","versionSpec":">=7.0.0","scope":"extra:pytest"},{"ecosystem":"pypi","name":"websockets","versionSpec":">=15.0","scope":"runtime"},{"ecosystem":"pypi","name":"wrapt","versionSpec":">=1.16.0","scope":"extra:google-adk"},{"ecosystem":"pypi","name":"xxhash","versionSpec":">=3.0.0","scope":"runtime"},{"ecosystem":"pypi","name":"zstandard","versionSpec":">=0.23.0","scope":"runtime"}],"advisories":[{"id":"2b867898-226e-41b1-bb5e-0fdbe00009b4","url":"https://aisecwatch.com/issues/2b867898-226e-41b1-bb5e-0fdbe00009b4","cveId":null,"title":"GHSA-f4xh-w4cj-qxq8: LangSmith SDK TracingMiddleware: Arbitrary server-side file read","headline":null,"severity":"high","publishedAt":"2026-06-19T22:10:34.000Z","affected":["langsmith@< 0.8.18 (fixed: 0.8.18)"],"epssScore":null},{"id":"51fb1fdb-be21-4f50-8ce9-9dcd9036cf68","url":"https://aisecwatch.com/issues/51fb1fdb-be21-4f50-8ce9-9dcd9036cf68","cveId":"CVE-2026-45134","title":"GHSA-3644-q5cj-c5c7: LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning","headline":null,"severity":"high","publishedAt":"2026-05-13T15:29:30.000Z","affected":["langchain@< 0.3.30 (fixed: 0.3.30)","langchain-classic@< 1.0.7 (fixed: 1.0.7)","langsmith@< 0.6.0 (fixed: 0.6.0)","langsmith@< 0.8.0 (fixed: 0.8.0)"],"epssScore":0.00344},{"id":"405115eb-9c98-4ab8-b561-3ab4a5551fa8","url":"https://aisecwatch.com/issues/405115eb-9c98-4ab8-b561-3ab4a5551fa8","cveId":null,"title":"GHSA-rr7j-v2q5-chgv: LangSmith SDK: Streaming token events bypass output redaction","headline":null,"severity":"medium","publishedAt":"2026-04-16T01:20:37.000Z","affected":["langsmith@<= 0.7.30 (fixed: 0.7.31)","langsmith@<= 0.5.18 (fixed: 0.5.19)"],"epssScore":null},{"id":"c1a405aa-3c42-4207-b47e-4454273b9bf8","url":"https://aisecwatch.com/issues/c1a405aa-3c42-4207-b47e-4454273b9bf8","cveId":"CVE-2026-40190","title":"GHSA-fw9q-39r9-c252: LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`","headline":null,"severity":"medium","publishedAt":"2026-04-10T20:18:02.000Z","affected":["langsmith@<= 0.5.17 (fixed: 0.5.18)"],"epssScore":0.00385}],"checkedAt":"2026-10-09T22:01:42.680Z"},"meta":{"advisoryMatching":"by package name; advisory records do not state an ecosystem"}}